Secure a small Microsoft 365 tenant in three connected areas: identity and administrator access, email and collaboration, and enrolled devices. Start by confirming multifactor authentication (MFA) is enforced, then reduce administrator privilege, verify mail protections, review endpoint policies, and roll out Baseline Security Mode changes only after checking their impact reports. The exact controls you can use depend on your Microsoft 365 subscription and the management tools already in the tenant.
What a Microsoft 365 security baseline covers
Microsoft’s business guidance groups tenant security into three areas:
As an Amazon Associate I earn from qualifying purchases.
- Account security: sign-in protection, MFA, administrator roles and recovery access.
- Email and collaboration security: Exchange Online, SharePoint, OneDrive and Teams protections against malware, spam, spoofing, malicious links and unsafe files.
- Device security: policies for enrolled phones, tablets and computers, plus endpoint protection and application controls.
These areas are linked. A strong mail policy cannot compensate for an unprotected administrator account, and a well-configured endpoint policy cannot stop an attacker who signs in with a stolen password. Review them together, but change one control at a time so that a dependency or mistaken policy does not interrupt the business.
Recommended Free Tools
The documentation and labels described here reflect Microsoft 365 for business as documented on October 13, 2026. Plan entitlements and admin-center workflows can change, so confirm the current options in your own tenant before enabling a policy.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Start with scope, subscriptions and permissions
Inventory the tenant before changing a setting
Record the tenant name, domain names, subscribed plans, active administrators, enrolled devices and any existing identity, mail or endpoint policies. The inventory tells you which controls should be present and prevents an administrator from creating a second policy that conflicts with one already in production.
Use an account with the appropriate role for each workload. Microsoft supports role-based access for Baseline Security Mode, and workload-specific administrators can manage the settings relevant to their area. Do not give every person Global Administrator rights simply because they need to manage one service.
Open Baseline Security Mode
In the Microsoft 365 admin center, go to Show all → Settings → Org Settings → Security and Privacy → Baseline Security Mode. Microsoft says this mode applies across Microsoft 365 apps, SharePoint and OneDrive, Teams, Exchange Online and Microsoft Entra. The page lets administrators review settings and their reported impact before activation. Microsoft’s Baseline Security Mode documentation lists the current controls and behavior.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Make MFA the first identity checkpoint
Check security defaults before assuming they are enabled
Every Microsoft 365 business subscription includes Microsoft Entra ID Free and security defaults. Security defaults are intended as the baseline identity protection and enable MFA. Tenants created after October 2019 have security defaults enabled by default, but an administrator can later change the setting, so verify it rather than relying on the tenant’s age.
In the Microsoft Entra admin center, the status text Your organization is protected by security defaults.
indicates that the baseline is on. If the tenant is not protected, do not leave MFA disabled while deciding what to do next. Microsoft’s MFA setup guidance recommends using either security defaults or Conditional Access.
Choose between security defaults and Conditional Access
Security defaults provide a straightforward set of protections for organizations that do not need per-user, per-app or per-location rules. Conditional Access offers more granular controls, but requires Microsoft Entra ID P1 or later. Microsoft 365 Business Premium includes Entra ID P1; the entitlement should still be confirmed in the tenant before you design a policy.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
They are alternatives, not layers that can be enabled together. Security defaults and Conditional Access cannot be active at the same time. If you move to Conditional Access, recreate the protections that security defaults supplied before switching the default off:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Require MFA for all users, including administrators.
- Block legacy authentication methods that cannot perform modern MFA.
- Require MFA when accessing Azure management interfaces.
Microsoft explicitly cautions against turning off security defaults unless you are making that deliberate transition. Test the new Conditional Access policies with a controlled group and an emergency recovery plan before applying them broadly.
| Identity option | When it fits | Important constraint |
|---|---|---|
| Security defaults | A baseline for organizations that want Microsoft-managed, broadly applied protections. | Less granular control over exceptions and conditions. |
| Conditional Access | Organizations needing rules by user, app, device, location or risk signal. | Requires Microsoft Entra ID P1 or later; it replaces security defaults rather than running beside them. |
Protect administrator accounts separately from daily work
Use least privilege and separate identities
The account used to enroll in Microsoft 365 for business is automatically a Global Administrator. That role can change tenant-wide settings, so limit the number of Global Administrators and assign narrower roles wherever they are sufficient.
Give each administrator an ordinary account for email, documents and routine collaboration. Create a separate administrator identity for elevated tasks and use it only when an administrative action requires the role. This separation reduces the chance that a malicious link opened during normal work also compromises the account that controls the tenant.
Prepare emergency access accounts
Microsoft recommends at least two emergency access accounts that are not assigned to specific individuals and are used only when normal administrative access fails. The guidance recommends excluding these accounts from MFA and protecting them with passwords of 16 or more characters. This exception needs operational controls: store the credentials securely, restrict who can retrieve them, alert on every sign-in and test the recovery process without using the accounts for ordinary work.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Document which administrators can authorize emergency use, how the credentials are retrieved and how the incident is reviewed afterward. An emergency account that nobody can access in a lockout is not a recovery plan.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Offer phishing-resistant sign-in methods
For administrator accounts, Microsoft lists passwordless choices including Microsoft Authenticator with push and biometric or PIN verification, FIDO2 passkeys and Windows Hello for Business. The cited guidance says these methods are supported through Entra ID Free for Business Basic and Business Standard. The practical choice depends on the administrator’s devices and enrollment process:
| Method | Useful when | Setup consideration |
|---|---|---|
| Microsoft Authenticator | Administrators carry a managed smartphone and can approve sign-ins with a biometric or device PIN. | Require registration on a controlled device and maintain a recovery method. |
| FIDO2 passkey | You want a dedicated hardware or platform credential that resists common phishing flows. | Check compatibility with the operating systems, browsers and account policies before purchasing or issuing keys. |
| Windows Hello for Business | Administrators use compatible Windows devices with a local PIN or biometric unlock. | Confirm device enrollment and organizational deployment requirements. |
Read Microsoft’s admin account security guidance for the current role, emergency-account and passwordless recommendations.
Review email and collaboration protections
Know what every business subscription includes
All Microsoft 365 business subscriptions include built-in cloud-mailbox protection against malware, spam and email spoofing. Microsoft identifies anti-malware, anti-spam and spoofing protection policies as enabled by default. Verify that nobody has weakened the defaults with an organization-specific transport rule, allow-list entry or policy exception.
Understand what Business Premium adds
Microsoft 365 Business Premium adds Defender for Office 365 Plan 1. Its listed capabilities include impersonation protection, Safe Attachments, Safe Attachments for SharePoint, OneDrive and Teams, and Safe Links. Those features are not included in every Microsoft 365 business subscription, so do not promise them to users on Basic or Standard.
Microsoft describes the default protections as a good starting level and recommends configuring more settings, including the Standard or Strict preset security policies, when the organization needs stronger coverage. A stricter preset can increase detections and user prompts; review the effect on legitimate senders, shared mailboxes and business workflows before selecting it.
| Protection area | Included across Microsoft 365 business subscriptions | Business Premium addition |
|---|---|---|
| Cloud-mailbox anti-malware | Yes; enabled by default according to Microsoft’s overview. | Uses the same baseline plus additional Defender for Office 365 capabilities. |
| Anti-spam and spoofing protection | Yes; default policies are identified as on. | Additional policy controls are available through the Premium security stack. |
| Impersonation protection | Not stated as included in every business subscription. | Included with Defender for Office 365 Plan 1. |
| Safe Attachments and Safe Links | Not stated as included in every business subscription. | Included with Defender for Office 365 Plan 1, including Safe Attachments coverage for SharePoint, OneDrive and Teams. |
Use the Microsoft 365 business security overview to map these capabilities to the plan actually assigned to each user. The page is served under a Thai-language URL, while the documented content is English.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check collaboration locations, not only Exchange
Files shared through SharePoint, OneDrive and Teams can carry the same business risk as an email attachment. If the tenant has Business Premium, verify that Safe Attachments policies cover those collaboration services and that Safe Links is applied to links delivered through mail and collaboration messages. Review exceptions for trusted senders and domains; every exception should have an owner and a reason.
Review device and endpoint security
Separate limited mobile controls from full management
All Microsoft 365 business subscriptions include Basic Mobility and Security. Microsoft describes it as a limited subset of Intune for securing access to company data on enrolled devices in supported apps.
Business Premium adds Intune Plan 1, broader mobile-device and mobile-application management, support for more device types including macOS, and Microsoft Defender for Business endpoint security. These are materially different administrative capabilities, so identify which devices are covered by the limited baseline and which require Premium enrollment.
| Device capability | All Microsoft 365 business subscriptions | Business Premium |
|---|---|---|
| Basic Mobility and Security | Included; limited controls for access to company data on enrolled devices in supported apps. | Included. |
| Intune Plan 1 | Not stated as included. | Included, with broader mobile device and application management. |
| macOS device coverage | Not stated as included through the limited baseline. | Included among the broader device types supported by Intune Plan 1. |
| Microsoft Defender for Business | Not stated as included. | Included for endpoint security. |
Review Defender for Business policies
In the Defender portal, review the default next-generation protection and firewall policies, attack surface reduction features and advanced-feature settings. The portal is designed as a simplified way to onboard devices, manage policies and view incidents. Confirm that every supported business device is either onboarded there or intentionally managed elsewhere.
Organizations already using Intune can continue using Intune. Microsoft warns that switching to Defender portal configuration requires deleting existing Intune security policies to avoid policy conflicts. Do not configure the same endpoint control in both places without a documented precedence plan; overlapping policies can produce confusing results and make troubleshooting harder.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Follow Microsoft’s current Defender for Business policy and settings instructions for the portal workflow and the conditions around moving from Intune-managed policies.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Roll out Baseline Security Mode in phases
Read the impact report for each setting
Baseline Security Mode settings can be managed independently. Microsoft recommends running an impact report for every setting before enabling it. When the report shows zero impacts, activation is the low-risk next step. When it identifies a critical dependency, resolve or redesign that dependency first.
A reported impact may reflect an application, automation, device, account or workflow that would stop working under the new control. Record the affected object, its owner, the business function and the proposed remediation. Do not treat a zero-impact report as proof that no future user will be affected; it is evidence for the current tenant state.
Use a dependency-aware change sequence
- Inventory plans and roles. Confirm subscription entitlements, existing administrators and which team owns identity, mail and endpoint settings.
- Inspect identity protection. Verify security defaults or design the Conditional Access replacement, then test administrator and user sign-in paths.
- Harden administration. Separate daily and admin identities, reduce Global Administrator assignments and prepare two emergency access accounts.
- Review mail and collaboration. Confirm default anti-malware, anti-spam and spoofing protections, then configure the Premium-only protections when the tenant is licensed for them.
- Review endpoint management. Identify Basic Mobility and Security coverage, Intune ownership and Defender for Business onboarding. Resolve any portal overlap before changing policy.
- Run Baseline Security Mode impact reports. Enable settings with no reported impact and defer settings with critical dependencies.
- Monitor after each change. Check sign-ins, mail flow, endpoint incidents, user reports and administrative alerts before enabling the next control.
Temporarily disable only to investigate a dependency
Microsoft states that administrators can temporarily disable a Baseline Security Mode setting to assess dependencies. Treat that as a diagnostic measure, not a permanent exception: document who disabled it, why, what was tested and the date for re-enablement. If the dependency cannot be removed, record the accepted risk and an owner who will revisit it.
A practical review checklist
- Tenant subscription and add-on entitlements are documented for each user group.
- Security defaults are verified, or a tested Conditional Access replacement is ready.
- Conditional Access is not being enabled alongside security defaults.
- All users and administrators have an MFA enrollment path.
- Global Administrator assignments are limited and reviewed.
- Daily work and administrative tasks use separate identities.
- Two emergency access accounts exist, have 16-or-more-character passwords, are excluded from MFA as documented, and generate sign-in alerts.
- Passwordless options are offered to administrators and compatibility is confirmed.
- Default anti-malware, anti-spam and spoofing policies have not been weakened by unreviewed exceptions.
- Business Premium tenants have reviewed impersonation protection, Safe Attachments and Safe Links where licensed.
- Basic Mobility and Security, Intune and Defender for Business ownership is clear for every device group.
- Endpoint policies are not being configured simultaneously in conflicting portals.
- Every Baseline Security Mode change has an impact report, dependency decision, owner and rollback or recovery plan.
Common failure modes and recovery actions
Turning off security defaults before Conditional Access is ready
Symptom: users lose the enforced MFA baseline while the new policies are incomplete. Fix: restore security defaults, or immediately complete and test Conditional Access policies for all users, administrators, legacy authentication blocking and Azure management MFA before removing the default protection.
Using one account for email and Global Administrator work
Symptom: a routine phishing incident also exposes tenant-wide administrative control. Fix: create a separate administrative identity, remove unnecessary Global Administrator assignments and reserve the daily account for ordinary work.
Conflicting Intune and Defender policies
Symptom: endpoint settings appear inconsistent, or a change in one portal is overwritten by another policy. Fix: choose the management portal, inventory and remove conflicting policies as required by Microsoft’s migration guidance, then reapply the intended configuration in one place.
Enabling a baseline setting despite a critical dependency
Symptom: an application, automation or sign-in path fails immediately after activation. Fix: use the documented temporary-disable option while investigating, address the dependency, rerun the impact assessment and schedule a controlled reactivation.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to keep the baseline current
Make this review a recurring operating task rather than a one-time setup. Recheck administrator roles, emergency-account access, MFA registration, subscription assignments, mail exceptions, device enrollment and Baseline Security Mode impact reports after major tenant, application or staffing changes. Microsoft can change plan entitlements and admin-center labels, so use the linked Microsoft Learn pages and the tenant’s current interface when validating a future review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
